5db5-rm2-lv2-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:12 'https://5db5public.s3.amazonaws.com/RM2Linux.zip')

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt binary plugin files (shared libraries: RM-2.so for LV2 and VST3) downloaded from an S3 bucket (5db5public.s3.amazonaws.com) rather than the vendor's official domain (audioassault.mx). The binaries are executed/loaded at runtime by audio hosts. While SHA-256 checksums are present and the S3 bucket appears to be the vendor's own distribution channel (the bucket name '5db5public' matches the pkgbase '5db5-rm2' and the vendor branding), S3 buckets are not the same as a verified official release page — the bucket could be taken over, the URL could be changed, or the object could be replaced without the maintainer noticing. This is a genuine supply-chain concern for executed code from a non-canonical host, which is the definition of medium severity. It is not high because there is no obfuscation, no exfiltration, and the checksum provides integrity verification at build time. The 'RM-2 Linker' script listed as a source has no URL, meaning it must be a local file submitted to the AUR alongside the PKGBUILD — this is slightly unusual but not inherently malicious, though it does mean an additional unverifiable artifact is being installed to /usr/bin.